v0.5.1

Fixes the npm publish pipeline. v0.5.0 was tagged and released but never reached npm — the publish job failed with E404 and the fix landed after that tag, so re-running it would have replayed the broken workflow.

Publish pipeline

The publish job authenticated with a token while these packages are configured for npm trusted publishing (OIDC). It also pinned node-version: '22' → npm 10.9.8, below the npm ≥ 11.5.1 floor for OIDC auth, so the CLI could never attempt the token exchange. Now on Node 24 (npm 11.16.0) with all NODE_AUTH_TOKEN blocks removed.

The E404 was misleading: npm returns 404 rather than 401/403 for scoped packages so it can't leak whether a package exists. The successful provenance signing in the failed log was a red herring too — --provenance is build attestation, independent of publish authentication.

Packaging

A stale 69.7 kB examples/codegen/build/index.node and gitignored generated/ sources were shipping in the tarball, because package.json files is authoritative and silently overrode .npmignore. 91 files / 132.4 kB → 87 files / 112.0 kB.

Also in this release

• Dead NapiError struct removed (never instantiated), plus two doc comments that promised it as a return value from functions that raise
• All four Dependabot alerts cleared — 0 vulnerabilities; added the .github/dependabot.yml that never existed
• CI retry loops removed from test.yml and publish.yml; the flake they masked was a use-after-free fixed in e2f4efe
• docs/EXPORTS.md completed (was missing 31 exports); README corrected to 4 classes / 615 tests; pixi ≥ 0.73 prerequisite documented

609 tests + 6 GC tests pass on macOS and Linux.